8009, the forgotten Tomcat port

We all know about exploitingTomcat using WAR files. That usually involves accessing the Tomcat manager interface on the Tomcat HTTP(S) port. The fun and forgotten thing is, that you can also access that manager interface on port 8009. This the port that by default handles the AJP (Apache JServ Protocol) protocol:

What is JK (or AJP)?

AJP is a wire protocol. It an optimized version of the HTTP protocol to allow a standalone web server such as Apache to talk to Tomcat. Historically, Apache has been much faster than Tomcat at serving static content. The idea is to let Apache serve the static content when possible, but proxy the request to Tomcat for Tomcat related content.

Also interesting:

The ajp13 protocol is packet-oriented. A binary format was presumably chosen over the more readable plain text for reasons of performance. The web server communicates with the servlet container over TCP connections. To cut down on the expensive process of socket creation, the web server will attempt to maintain persistent TCP connections to the servlet container, and to reuse a connection for multiple request/response cycles

It’s not often that you encounter port 8009 open and port 8080,8180,8443 or 80 closed but it happens. In which case it would be nice to use existing tools like metasploit to still pwn it right? As stated in one of the quotes you can (ab)use Apache to proxy the requests to Tomcat port 8009. In the references you will find a nice guide on how to do that (read it first), what follows is just an overview of the commands I used on my own machine. I omitted some of the original instruction since they didn’t seem to be necessary.

Don’t forget to adjust worker.ajp13.host to the correct host. A nice side effect of using this setup is that you might thwart IDS/IPS systems in place since the AJP protocol is somewhat binary, but I haven’t verified this. Now you can just point your regular metasploit tomcat exploit to 127.0.0.1:80 and take over that system. Here is the metasploit output also:

Thank you for everything you have informed me of.Im basically learning the programming side of this universe of knowledge and know a bit of the hardware with a lot electrical and electronic but I know where people can abuse power they will. I notice the port open when I opened a streanming device on t he exact date you quoted me and I’m mind boggled. I just have been wondering how to protect myself from anyone trying to do harm to me through my own info.I appreciate all your help and all I have is a smartphone so I doubt I could ipconfig anything . I’ve been noticing things for a while whether true or not but it didn’t make since that I shouldn’t be able to pick a nontainted proxy for my streaming.

If Kali Linux is used, it would be required to install libapache2-mod-jk. This can be found in the default repo, using:
apt-get install libapache2-mod-jk

As for the rest, it’s pretty much the same.

A quick side note, in the most current metasploit version (v4.10.0-2014102901 [core:4.10.0.pre.2014102901 api:1.0.0]) the exploit module used in the blog post supports different payloads than the one used in example, as can be seen below: